AI agents: a security checklist for CISOs

An AI agent is a model wrapped in a loop: it reads a goal, chooses a tool, acts, reads the result and repeats. From a security standpoint that makes it a new kind of principal on your network, one that holds credentials, follows instructions it finds in data, and can run thousands of actions an hour. The incidents of the past month, from the Claude Code settings file that put 2,539 secrets on GitHub to the ARTEX campaign that hit 200 organisations, map neatly onto controls most security teams already understand. This checklist puts them in order.

1. Inventory every agent and what it can touch

You cannot govern what you have not listed. Start with coding agents on developer laptops, then browser and desktop agents, then anything running server-side with API keys. For each, record the identity it runs as, the tools it can call and the data it can read. Expect to find more than you budgeted for; they arrive inside products.

2. Give agents their own identities

An agent that uses a human's credentials is indistinguishable from that human in your logs. Issue each agent a non-human identity with its own secrets, scoped roles and expiry. This is the control that makes every later control auditable, and it is why Palo Alto Networks was reportedly willing to pay about $500 million for an agent-identity startup this month.

3. Least privilege, enforced outside the model

Scope tool permissions to the task and enforce them in the tool layer, not in the prompt. A model told not to delete records will usually comply; a database role that cannot delete records always complies. Require a human approval step for irreversible actions: payments, sending external messages, destructive commands.

4. Treat agent configuration as secret-bearing

Agent folders such as .claude/, .cursor/ and .gemini/, plus memory and transcript files, hold approved commands, tool allowlists and sometimes credentials. Add them to pre-commit hooks, CI secret scanning and .gitignore templates, and scan git history, not just the current tree. Apiiro's research found standard scanners missed 215 of 1,122 leaking files because the passwords were embedded in shell commands.

5. Assume prompt injection succeeds

Any agent that reads untrusted content, including web pages, emails, tickets or repositories, can be instructed by that content. Resistance in the model is probabilistic. Design so that a hijacked agent cannot do real damage: separate the agent that reads untrusted data from the one that holds write permissions, and strip or sandbox content before it reaches a privileged agent.

6. Log every action, not just every prompt

Capture tool calls, parameters and results with the agent's identity, and keep them as long as you keep access logs. When something goes wrong you need to reconstruct what the agent did, in order, with timestamps.

7. Rate-limit and budget

Autonomous loops fail loudly. The ARTEX intrusions consumed more than 1.4 billion input tokens in a single breach and generated 450,000 requests against one victim. Caps on tokens, requests and spend per agent per hour are both a cost control and an early-warning signal, and a stolen API key is now a weapon as well as a bill.

8. Patch faster than the agents attack

AI-assisted vulnerability discovery has compressed the window between disclosure and exploitation. The OpenSSH password bypass fixed on November 5 was exploited in the wild within nine hours. Measure time-to-patch for internet-facing systems in hours, and alert on authentication anomalies and request volume, not only on known signatures.

9. Review vendors' agents too

Your SaaS vendors are deploying agents inside the tools you already use, and their third-party software is in your blast radius. Anthropic's recent customer notice traced exposure of account and plan data to a vulnerability in a vendor's business application, not the model. Ask suppliers which agents touch your data, under what identity and with what sub-processors.

10. Rehearse the incident

Run a tabletop for a hijacked agent: a coding agent that pushed a credential, a support agent that issued refunds on injected instructions, a browser agent that leaked a session. Decide in advance who can revoke an agent's identity and how fast.